PT-2025-1843 · Ac500 V3 · Ac500 V3

Published 2025-01-07 · Updated 2025-01-13 · CVE-2024-12430

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AC500 V3 versions prior to 3.8.0

Description An attacker who successfully exploits this issue could cause command execution. The vulnerability exists in the AC500 V3 version, where after successfully exploiting a directory traversal vulnerability, a successfully authenticated attacker can inject arbitrary commands into a specifically crafted file, which then will be executed by the root user.

Recommendations For versions prior to 3.8.0, update the firmware to version 3.8.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable directory to minimize the risk of exploitation. Avoid using specifically crafted files that could be used to inject arbitrary commands until the issue is resolved.

Fix

Weakness Enumeration

CWE-280

Related Identifiers

CVE-2024-12430

Affected Products

Ac500 V3

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-12430 · Security Note
• https://twitter.com/CyberDanube/status/1878771649354580314 · Twitter Post
• https://twitter.com/CVEnew/status/1876890100946362510 · Twitter Post
• https://search.abb.com/library/Download.aspx?DocumentID=3ADR011377&LanguageCode=en&DocumentPartId=&Action=Launch · Note